Create a custom property for data connections. Assign to this data connection. Then create a rule that allows users to read all data connections that are not equal to this value. Set to Only in Hub. There might be a default rule that you need to disable. But not sure about that.
I think that will do what you want.
It looks like you can create a security rule concerning Data Connection access. I'm not sure how to hide one for a specific Data Connection as I really stay more on the dev side, and shy away from the Admin side. But it's worth giving a try.
It appears you can also create an associated rule for a specific Data Connection too, which should cut down on indirection.